Live › vulnerability › CVE-2026-77524
Go to dashboardKEDA 2.20.2 and earlier let a namespace admin who can create TriggerAuthentication and ScaledObject resources point a Vault address at an attacker-controlled endpoint, and KEDA then sends the operator pod's ServiceAccount token to it as a Vault login. The stolen token carries the operator's cluster-wide permissions, including broad Secret reads, so the attacker can escalate from namespace admin to cluster admin.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/kedacore/keda | go | all versions | – |
| github.com/kedacore/keda/v2 | go | < 2.21.0 | 2.21.0 |
2.20.2 and earlier are affected2.21.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Kubernetes authentication without an explicit credential. KEDA then uses the operator pod's projected ServiceAccount token and sends it to that endpoint as a Vault login credential. The JWT-shape filter from the prior CVE-2025-68476 remediation accepts the operator token because its subject is a Kubernetes ServiceAccount, so the attacker can obtain the operator's cluster-wide permissions, including broad Secret reads and workload or admission-related operations. This vulnerability is fixed in 2.21.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-77524")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.